Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 0 down vote favorite

I am using iptables to listen to tcp (http) packets. I am filtering out INPUT responses containing a matching string. Is it possible to know which http request generated the response. Assuming 10 requests were sent to the same server and one response containing matching string was generated by one of the 10 requests. Is it possible to figure out which request generated the response using iptables, by using markers!

share|improve this question
1  
Do you just mean at a TCP level? The destination port of the reply matches the source port of the request, so you can at least tie it to the TCP session. There may be multiple requests within a single session however. – Paul Sep 30 '12 at 12:49
Yes, there are multiple requests and responses. I want to match all responses corresponding to requests, all requests being sent to the same server – adnan kamili Sep 30 '12 at 13:14
Did you follow what I meant by source port? – Paul Oct 1 '12 at 1:40
All the browsers use http pipelining. I suppose all the requests sent by any open tab will use same source port for all the requests. Different tabs in a browser use different source ports. – adnan kamili Oct 1 '12 at 2:30
What are you trying to accomplish? – Yedric Oct 1 '12 at 13:43
show 2 more comments

1 Answer

up vote 2 down vote

iptables is not the right tool for filtering HTTP, because that protocol works on top of TCP/IP (which iptables was designed to handle). The problem is, that a HTTP request (or response) may span multiple TCP packets. A proxy (e.g. Squid) is probably a better solution for your problem. Or perhaps l7-filter.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.